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COPY BOOT CODE TO RAM 



(54) Electronic apparatus including a memory device and method of reprogramming the memory 
device 



(57) A method of reprogramming memory 911) stor- 
ing program instruction code for controlling operation of 
a microprocessor in which new data can be written to 
the memory by the microprocessor only in a write cycle 
and stored data can be read from the memory by the 
microprocessor only in a read cycle, the memory pre- 
venting the read cycle and said write cycle occuring at 
the same time is disclosed. The memory has first and 
second sectors {30, , 30 2 ) for storing code, the first sec- 
tor (30-,) storing boot code for controlling operation of 
the microprocessor. The disclosed method includes the 
steps of erasing code stored in the second sector (30 2 ), 
writing new code including the boot code to the second 
sector, erasing the first sector (30-,), writing new boot 
code in the first sector preceded by an instruction to 
jump to said second sector and then rendering the jump 
instruction ineffective so that the next boot of the micro- 
processor will cause the microprocessor to be controlled 
by the new boot code in the first sector. 
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Description 

This invention relates to electronic apparatus in- 
cluding one or more memory devices tor storing data 
and in particular to electronic apparatus including one 
or more so-called "Flash" memory devices. 

Flash memory devices are well known in the data 
processing art and comprise circuits including semi- 
conductors designed to store electrical signals in a non- 
volatile manner. That is to say such memory devices 
continue to store signals representing data even when 
electrical power to the circuit is terminated. Unlike some 
other semi-conductor storage devices used for non-vol- 
atile storage of data, flash memory devices have the ca- 
pability of being reprogrammed, i.e. the data stored in 
flash memory devices can be erased and new data writ- 
ten into the memory, without removal of the device from 
the electronic apparatus. Semi-conductor devices 
which require to be removed to enable reprogramming 
of the device need to be removably mounted in a device 
socket and this leads to increased cost of manufacture 
of the apparatus as well as a potential loss in reliability 
due to possible resistance in the interface between pins 
of the device and pin receiving sockets of the device 
socket. For reliability and reduction in cost of manufac- 
ture it is desirable for the memory device to be perma- 
nently soldered, for example by surface mounting, to 
electrical connections of a printed circuit board. 

Flash memory devices may be programmed prior 
to being soldered to the printed circuit board. When a 
flash memory device is utilised for storing program in- 
struction code including boot software instruction code, 
a microprocessor of the apparatus operating under the 
control of the program instruction code needs to read at 
least the boot code from the memory in order to perform 
functions including reprogramming of the memory. Ac- 
cordingly in order to reprogram the memory it is neces- 
sary for the microprocessor to be able to read instruction 
code from the memory as well as to write new instruction 
code into the memory However flash memory devices 
do not permit programming or reprogramming of the 
memory at the same time as reading data or code from 
the memory. Therefore it is necessary for the program 
instruction code, including the boot code, to be stored 
in another memory device from which the microproces- 
sor can read the program instruction code so as to op- 
erate under the code stored in the other memory device 
to perform the operations required for reprogramming 
the flash memory. Therefore, in known electronic appa- 
ratus or systems incorporating flash memory where the 
flash memory is intended not to be removed from the 
apparatus for reprogramming, if it is desired to repro- 
gram the flash memory the apparatus is provided with 
a separate memory device to hold 'boot' software in- 
struction code. Usually in microprocessor operated 
electronic apparatus, random access memory is provid- 
ed for the temporary storage of data during operation of 
the microprocessor. Accordingly the random access 



memory may be used to store the program instruction 
code and the microprocessor is operated under control 
of the instruction code stored in the random access 
memory while the reprogramming of the flash memory 

5 is effected. Initially the microprocessor, operating under 
the program instruction code stored in the flash memory, 
reads the code from the flash memory and writes the 
code to the random access memory. Thus a copy of the 
program instruction code is stored in the random access 

to memory. A signal then switches operation of the micro- 
processor from being under control of code stored in the 
flash memory to being under control of the code stored 
in the random access memory. This switching signal is 
a hardware signal 

is it will be appreciated that the random access mem- 

ory is volatile and any data or code stored therein is lost 
when power to the memory is terminated While the en- 
tire program instruction code is still stored in the non- 
volatile flash memory, the system remains in an opera- 
te* tional condition and when power is restored the micro- 
processor will be operable once again under control of 
the program instruction code stored in flash memory. 
However if the power supply fails and the supply of pow- 
er to the random access is terminated, the program in- 

25 struction code previously stored in the random access 
memory is lost and in addition the original program in- 
struction code in the flash memory will have been wholly 
or partially erased and only a part of the new instruction 
code written to the flash memory. Accordingly as a result 

30 of loss of power and consequent shut down of the sys- 
tem there is no longer stored in the system a complete 
original program instruction code or complete new pro- 
gram instruction code. Without a complete program in- 
struction code, the microprocessor is incapable of oper- 

35 ating and the system remains inoperative until such time 
as the flash memory device is replaced or is repro- 
grammed by a different less convenient method. 

According to one aspect of the invention in a meth- 
od of reprogramming memory storing program instruc- 

40 tion code for controlling operation of a microprocessor 
in which new data can be written to the memory by the 
microprocessor only in a write cycle and stored data can 
be read from the memory by the microprocessor only in 
a read cycle, said memory preventing the read cycle and 

45 said write cycle occurring at the same time wherein the 
memory has at least first and second sectors for storing 
code, said first sector storing boot code for controlling 
operation of the microprocessor, the method is charac- 
terised by the steps of erasing code stored in said sec- 

50 ond sector; writing new code to said second sector, said 
new code including said boot code; erasing the first sec- 
tor, said first sector when erased being in a state such 
that the microprocessor in executing the boot code runs 
through to the boot code stored in the second sector; 

55 writing new boot code in said first sector preceded by 
an instruction to jump to said second sector; and then 
rendering the jump instruction ineffective whereby the 
next boot of the microprocessor will cause the micro- 
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processor to be controlled by said new boot code in said 
first sector. 

According to another aspect of the invention elec- 
tronic apparatus includes memory reprogrammable by 
the method defined hereinbefore. The electronic appa- 
ratus may be postage metering apparatus. 

An embodiment of the invention will now be de- 
scribed by way of example with reference to the draw- 
ings in which:- 

Figure 1 is a block diagram of electronic apparatus 
comprising a postage meter, 

Figure 2 illustrates a flash memory having a plurality 
of sectors, 

Figure 3 is a flow chart illustrating steps in repro- 

gramming the flash memory, and 

Figure 4 is a flow chart of a checking sub-routine. 

Referring first to Figure 1, the postage meter in- 
cludes electronic accounting and control means com- 
prising a micro-processor 10 operating under program 
routines stored in a flash memory 11. A keyboard 12 is 
provided for input of commands and data by a user and 
a display 1 3 is provided to enable display of information 
to the user. A random access memory (RAM) 14 is pro- 
vided for use as a working store for storage of temporary 
data during operation of the postage meter. Non-volatile 
duplicated memories 15,16 are provided for the storage 
of critical data relating to use ol the postage meter and 
which is required to be retained even when the postage 
meter is not powered. The microprocessor 10 carries 
out accounting functions in relation to use of the postage 
meter tor franking mail items with postage charges ap- 
plicable to handling of the mail items by the postal au- 
thority or another carrier. Accounting data relating to use 
of the postage meter for printing franking impressions 
representing postage charges for mail items and any 
other critical data to be retained is stored in the non- 
volatile memories 15, 16. The accounting data includes 
a value of credit available for use by the meter in franking 
mail items, an accumulated total of value used by the 
meter in franking mail items, a count of the number of 
mail items franked by the meter and a count of the 
number of mail items franked with a postage charge in 
excess of a predetermined value. The value of credit is 
stored in a descending credit register, the accumulated 
total value is stored in an ascending tote register, the 
count of items is stored in an items register and the count 
of items franked with a postage charge in excess ot a 
predetermined value is stored in a large items register. 
As is well known in the postage meter art, each of the 
registers referred to hereinbefore for storing accounting 
data is replicated in order to enable integrity of the ac- 
counting data to be maintained even in the event of a 
fault or termination of power to the meter during a frank- 
ing operation. Two replications of each of the registers 
are provided in each of the memory devices 15, 16. 

A motor controller 1 7 is controlled by the microproc- 



essor 1 0 to control operation of motors 18 driving feed- 
ing means (not shown) for feeding a mail item past a 
digital print head 19. Sensors 20 are provided to sense 
and monitor feeding of the mail item. An input/output 

5 port 21 is provided to enable communication between 
the postage meter and external apparatus. A power sup- 
ply 22 receiving power from a mains supply of electricity 
provides power at the required voltages to components 
of the postage meter. 

10 u will be appreciated that, as is well known in the 
postage meter art, the postage meter must operate in a 
secure manner and be protected from attempts to use 
the meter fraudulently for example by utilising the post- 
age meter to print franking impressions on mail items 

is for which no corresponding postage charge has been 
accounted for by the accounting means. Accordingly 
those parts of the postage meter required to be secured 
against unauthorised tampering are housed in a secure 
housing 23. 

20 Referring now to Figure 2 and 3, Figure 2 illustrates 
the sectored architecture of the flash memory device 11 . 
In the illustration of Figure 2 the memory is shown by 
way of example as having eight sectors 30 numbered 
30 1 to 30 8: however it is to be understood that the flash 

25 memory device may have a different number of sectors. 
When reprogramming the flash memory 11 only whole 
sectors 30 can be erased at any time. Initially the pro- 
gram instruction boot code is stored in sector 30t and 
the microprocessor is arranged to access this sector 30 1 

30 whenever the microprocessor is reset. Program instruc- 
tion code, other than boot code is stored in one or more 
of the remaining sectors 30 2 to 30 e . 

When a reprogramming operation to write new code 
into the flash memory is to be performed, the boot code 

35 stored in sector 30-, is copied to RAM 14 and operation 
of the microprocessor is switched to be controlled by the 
boot code now stored in RAM 1 4. Then the code stored 
in all of the sectors 30 2 to 30 8 is erased while leaving 
sector 30-, containing the boot code unerased. Repro- 

40 gramming of sectors 3038 with new program instruction 
code is then commenced. The new programming in- 
struction code includes, for storing at the top of sector 
30 2 , a copy of the boot code already stored in sector 
30^ If reprogramming is interrupted prior to completion 

45 of reprogramming of sectors 30 2 to 30 8 the code in these 
sectors will be incomplete or garbled. When the system 
is reset and the microprocessor is rebooted, the micro- 
processor is able to operate under the control of the boot 
__code in sector 30 1 which up until now has not been 

50 erased or rewritten. As part of the routine performed un- 
der the control of the boot code, the microprocessor per- 
forms a sub-routine to check on the code in the flash 
memory as illustrated by Figure 4. A checksum is per- 
formed in respect of the stored code and if the checksum 

55 of the code is OK, the microprocessor continues with 
normal program execution. However if the checksum is 
not OK, indicating incomplete or garbled code stored in 
sectors 30 2 30 8 of the flash memory, the microprocessor 
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re-enters the reprogramming routine and proceeds to 
pertorm the reprogramming sequence. 

When reprogramming of sectors 30 2 to 30 8 has 
been completed successfully, as determined by the 
checksum sub-routine ot Figure 4, reprogramming of 5 
sector is commenced. Sector 30^ is erased. If re- 
programming of sector 30-, is interrupted at this stage 
the whole of sector 30 1 contains microcode FF (hex), 
this being the microcode resulting from erasure of the 
storage locations in the sector. Therefore, upon reboot 10 
of the system after an interruption, the microprocessor 
will execute the sector 30-, containing FF (hex) and 
harmlessly continue until the program routine runs into 
the start of sector 30 2 which contains the boot code. Ex- 
ecution of the boot code will include carrying out the *5 
checksum sub-routine and detection of a bad code 
checksum in respect of sector 30j will be detected A 
further attempt to reprogram sector 30-, will be made. 

Initially, in reprogramming sector 30 A , the first bytes, 
for example three bytes, are left in the erased state of 20 
FF (hex). The next bytes, for example three bytes, are 
programmed with a jump instruction 'JMP BOOT2' to 
cause the program to jump to the boot code of sector 
30 2 . The remainder of the sector 30-, is reprogrammed 
with the boot code followed by any other code or data 25 
to be located in sector 30^ Finally when the code now 
programmed into sector 30 t has been verified by the 
checksum sub-routine of Figure 4, the first bytes of sec- 
tor 30-, are programmed from FF (hex) to 'JMP BOOT1 '. 
Hence upon rebooting of the system, execution of the 30 
program will first encounter the jump instruction 'JMP 
BOOT1 1 and the program will jump to the boot code lo- 
cated in sector 30^ immediately after the jump instruc- 
tion 'JMP BOOT2' thereby by-passing this latter instruc- 
tion. Thus it will be appreciated that apart from the rel- 35 
atively short time period of the order of a few millisec- 
onds when the instruction JMP BOOT2 is programmed 
into the flash memory and later during the equally short 
time period when the instruction JMP BOOT1 is pro- 
grammed into the memory, the flash memory contains 40 
fully executable boot code and the system can recover 
from any interruption of reprogramming the flash mem- 
ory. 

While the system described hereinbefore relates to 
reprogramming of flash memory it is to be understood 45 
that it is also applicable to other forms of non-volatile 
memory in which the memory does not permit writing of 
new data into the memory at the same time as reading 
data from the memory. 

so 

Claims 



the memory by the microprocessor only in a read 
cycle, said memory preventing the read cycle and 
said write cycle occurring at the same time wherein 
the memory has at least first and second sectors 
(30.,, 30 2 ) for storing code : said first sector (30-,) 
storing boot code for controlling operation of the mi- 
croprocessor, the method being characterised by 
the steps of erasing code stored in said second sec- 
tor (30 2 ); writing new code to said second sector 
(30 2 ) ; said new code including said boot code; eras- 
ing the first sector (30-,), said first sector when 
erased being in a state such that the microproces- 
sor in executing the boot code runs through to the 
boot code stored in the second sector; writing new 
boot code in said first sector preceded by an instruc- 
tion to jump to said second sector; and then render- 
ing the jump instruction ineffective whereby the next 
boot of the microprocessor will cause the micro- 
processor to be controlled by said new boot code in 
said first sector. 

2. A method as claimed in claim 1 wherein after writ- 
ing new code to the second sector (30 2 ), the micro- 
processor (10) carries out a check to determine if 
the new code has been successfully written in the 
second sector. 

3. A method as claimed in claim 1 or 2 wherein after 
writing new boot code to the first sector (30^, the 
microprocessor (10) carries out a check to deter- 
mine if the new boot code has been successfully 
written in the first sector. 

4. A method as claimed in any preceding claim 
wherein the memory (11) is non-volatile. 

5. A method as claimed in any claim 4 wherein the 
memory (11) is a flash memory device. 

6. A method as claimed in any preceding claim 
wherein prior to commencement of the reprogram- 
ming of the memory (11), the boot code stored in 
the first sector (30,) is copied to a volatile memory 
device (14). 

7. Electronic apparatus including memory (11) re- 
programmable by the method as claimed in any pre- 
ceding claim. 

8. Postage metering apparatus including memory 
(11) reprogrammable by the method as claimed in 
any one of claims 1 to 7. 



1. A method of reprogramming memory (11) storing 
program instruction code for controlling operation 55 
of a microprocessor (10) in which new data can be 
written to the memory by the microprocessor only 
in a write cycle and Stored data can be read from 
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(57) A method of reprogramming memory 91 1 ) stor- 
ing program instruction code for controlling operation of 
a microprocessor in which new data can be written to 
the memory by the microprocessor only in a write cycle 
and stored data can be read from the memory by the 
microprocessor only in a read cycle, the memory pre- 
venting the read cycle and said write cycle occuring at 
the same time is disclosed. The memory has first and 
second sectors (3Q,, 30 2 ) for storing code, the first sec- 
tor (3CJ,) storing boot code for controlling operation of 
the microprocessor. The disclosed method includes the 
steps of erasing code stored in the second sector (30 2 ), 
writing new code including the boot code to the second 
sector, erasing the first sector (30^, writing new boot 
code in the first sector preceded by an instruction to 
jump to said second sector and then rendering the jump 
instruction ineffective so that the next boot of the micro- 
processor will cause the microprocessor to be controlled 
by the new boot code in the first sector. 
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